diff --git a/package/apparmor/Config.in b/package/apparmor/Config.in
index edc837366d..d02838f800 100644
--- a/package/apparmor/Config.in
+++ b/package/apparmor/Config.in
@@ -26,6 +26,40 @@ config BR2_PACKAGE_APPARMOR_BINUTILS
 	  A set of utilities (written in C):
 	    aa-enabled    aa-exec
 
+comment "utils need python3"
+	depends on !BR2_PACKAGE_PYTHON3
+
+config BR2_PACKAGE_APPARMOR_UTILS
+	bool "utils"
+	depends on BR2_PACKAGE_PYTHON3
+	select BR2_PACKAGE_PYTHON3_READLINE
+	help
+	  A set of utilities (written in pyhon):
+	    aa-audit          aa-disable      aa-logprof
+	    aa-autodep        aa-easyprof     aa-mergeprof
+	    aa-cleanprof      aa-enforce      aa-status
+	    aa-complain       aa-genprof      aa-unconfined
+
+if BR2_PACKAGE_APPARMOR_UTILS
+
+comment "utils (extras) need bash and perl, and busybox or gawk"
+	depends on !BR2_PACKAGE_BASH || !BR2_PACKAGE_PERL \
+		|| !(BR2_PACKAGE_BUSYBOX || BR2_PACKAGE_GAWK)
+
+config BR2_PACKAGE_APPARMOR_UTILS_EXTRA
+	bool "utils (extras)"
+	depends on BR2_PACKAGE_BASH
+	depends on BR2_PACKAGE_PERL
+	depends on BR2_PACKAGE_BUSYBOX || BR2_PACKAGE_GAWK
+	help
+	  An extra set of utilities (written in a mixture of sh,
+	  bash, perl, and awk):
+	    aa-decode          (bash + perl)
+	    aa-notify          (perl)
+	    aa-remove-unknown  (sh + awk)
+
+endif # BR2_PACKAGE_APPARMOR_UTILS
+
 endif # BR2_PACKAGE_APPARMOR
 
 comment "apparmor needs a toolchain w/ headers >= 3.16, threads, C++"
diff --git a/package/apparmor/apparmor.mk b/package/apparmor/apparmor.mk
index 9ee5304a16..ab0b7778d6 100644
--- a/package/apparmor/apparmor.mk
+++ b/package/apparmor/apparmor.mk
@@ -21,6 +21,20 @@ ifeq ($(BR2_PACKAGE_APPARMOR_BINUTILS),y)
 APPARMOR_TOOLS += binutils
 endif
 
+ifeq ($(BR2_PACKAGE_APPARMOR_UTILS),y)
+APPARMOR_DEPENDENCIES += host-python3 python3
+APPARMOR_TOOLS += utils
+APPARMOR_MAKE_OPTS += PYTHON=$(HOST_DIR)/bin/python3
+
+ifeq ($(BR2_PACKAGE_APPARMOR_UTILS_EXTRA),)
+define APPARMOR_UTILS_NO_EXTRA
+	$(Q)rm -f $(addprefix $(TARGET_DIR)/usr/sbin/,aa-decode aa-notify aa-remove-unknown)
+endef
+APPARMOR_POST_INSTALL_TARGET_HOOKS += APPARMOR_UTILS_NO_EXTRA
+endif # BR2_PACKAGE_APPARMOR_UTILS_EXTRA
+
+endif # BR2_PACKAGE_APPARMOR_UTILS
+
 define APPARMOR_BUILD_CMDS
 	$(foreach tool,$(APPARMOR_TOOLS),\
 		$(TARGET_MAKE_ENV) $(TARGET_CONFIGURE_OPTS) \